CVE-2025-4805

MediumCVSS 4.8/10Last modified Aug 8, 2026

Description

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Access Portal configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.

Metrics

CVSS 4.0 4.8/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 12.0, < 12.11.2

References

Timeline

Published: May 16, 2025
Last modified: Aug 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-480507.5In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.CVE-2025-480516.1powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extr CVE-2025-480537.5Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, an CVE-2025-480546.8Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pol CVE-2025-480555.4Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user po CVE-2025-480565.3Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network CVE-2025-480579.8Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance dat CVE-2025-480586.3PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomia CVE-2025-480592.7PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to CVE-2025-48068.8A vulnerability, which was classified as critical, has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected by this CVE-2025-480607.5jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` i CVE-2025-480615.6wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being